Java 登录请求操作

public boolean checkLogin(String username,String password){

    String sql="select * from user" + "where username='"+username +"' and password ='"+password"';
    List<UserInfo> list =userdao.query(sql);
return list.size()>0 ? true:false;

}

public List query(String sql)
{
    String[] columns={"username","password","email"};
    return query(sql,columns); 
}

protect List query(String sql,String[] columns){
    List list=new ArrayList();
    Map map=null;
    openconnection();
try{
    ps=conn.prepareStatement(sql);
    rs=ps.executeQuery();
    while(rs,next()){
    map=new HashMap();
    for(int i=0;i<columns.length;i++)
    {
        map.put(colomns[i],rs.getObject(columns[i]));
    }
    list.add(map);
    }
 }catch(SQLException e)......